Trojan:Win32/Cosmu.AC!MTB (file analysis)

The Trojan:Win32/Cosmu.AC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Cosmu.AC!MTB virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Authenticode signature is invalid

How to determine Trojan:Win32/Cosmu.AC!MTB?


File Info:
name: 3856A62F7B0660F44D0D.mlw
path: /opt/CAPEv2/storage/binaries/6816657f165ad38045dbca298b40e141a611f09086296979c43719ee2b74d9ce
crc32: D4A8D2AE
md5: 3856a62f7b0660f44d0d52380819b1ad
sha1: e0684288f2945523a2969d742aeee67d5ad43ba6
sha256: 6816657f165ad38045dbca298b40e141a611f09086296979c43719ee2b74d9ce
sha512: 01d26dbef7920139a59df046fdd121ba2735e645faeec4e0342da3cf80f6c5dcf83cadc68eea38debe49ec24e1d0fd7e55503c74a31ac9e0a94b02270a4681c1
ssdeep: 768:uEaz5G7MaEtbwQpeyjaSLyfOPT4xcsrRA9Xu/IC4X3i2AH350azknSRXJuRWQlhw:v4GYUWeypTUuuQj635cSRU3iN/ntN7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T171433A87EE5D40D0E6155A30896D237DCAB7947E4B30EBAB5788DD3C2837480EC3A769
sha3_384: e72ed52fee9f7b40eff0a646a07e1d330d0a3ed01bdc37fcec4cb461e55b298b16f49ab9bfc685e157e0f8936e242caf
ep_bytes: 558bec6aff68e0a5400068c886400064
timestamp: 2007-10-23 12:03:54

Version Info:
Comments: 
CompanyName: 
FileDescription: System File
FileVersion: 2, 0, 0, 1
InternalName: brdr
LegalCopyright: Copyright (C) 2007
LegalTrademarks: 
OriginalFilename: Omer
PrivateBuild: 
ProductName: Browser Driver
ProductVersion: 2, 0, 0, 1
SpecialBuild: 
Translation: 0x0409 0x04b0

Trojan:Win32/Cosmu.AC!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Adware.Heur.dq1@IutA33ci
FireEye	Generic.mg.3856a62f7b0660f4
CAT-QuickHeal	Adware.Zenosearch.A4
Skyhigh	BehavesLike.Win32.AdwareZeno.qm
McAfee	Adware-Zeno.gen.b
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Adware.ZenoSearch.Win32.200
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Adware ( 004ca0081 )
K7GW	Adware ( 004ca0081 )
Cybereason	malicious.8f2945
Arcabit	Adware.Heur.EF40FE
VirIT	Adware.Win32.ZenoSearch.AC
Symantec	Downloader
ESET-NOD32	Win32/Adware.ZenoSearch
APEX	Malicious
ClamAV	Win.Adware.Zeno-4
Kaspersky	Trojan-Ransom.Win32.PornoAsset.cwgx
BitDefender	Gen:Adware.Heur.dq1@IutA33ci
NANO-Antivirus	Riskware.Win32.ZenoSearch.lyap
Avast	Win32:AdwareX-gen [Adw]
Tencent	Malware.Win32.Gencirc.10b270da
Emsisoft	Gen:Adware.Heur.dq1@IutA33ci (B)
F-Secure	Adware:W32/ZenoSearch.AQ
DrWeb	Adware.ZenoSearch
VIPRE	Gen:Adware.Heur.dq1@IutA33ci
TrendMicro	ADW_ZENOSEARC.BC
Sophos	ZenoSearch (PUA)
Ikarus	Trojan-Downloader
Jiangmin	Adware/Agent.bdc
Webroot	Adware.Zenosearchassistant
Google	Detected
Avira	TR/Downloader.Gen
Varist	W32/ZenoSearch.A.gen!Eldorado
Antiy-AVL	GrayWare[AdWare]/Win32.ZenoSearch
Xcitium	Application.Win32.Adware.ZenoSearch@403u
Microsoft	Trojan:Win32/Cosmu.AC!MTB
ZoneAlarm	Trojan-Ransom.Win32.PornoAsset.cwgx
GData	Gen:Adware.Heur.dq1@IutA33ci
Cynet	Malicious (score: 100)
AhnLab-V3	Adware/Win32.ZenoSearch.R7597
BitDefenderTheta	Gen:NN.ZexaF.36744.dq1@autA33ci
ALYac	Gen:Adware.Heur.dq1@IutA33ci
MAX	malware (ai score=68)
VBA32	AdWare.ZenoSearch
Cylance	unsafe
Panda	Adware/Zenosearch
TrendMicro-HouseCall	ADW_ZENOSEARC.BC
Rising	Trojan.Win32.Mnless.zwo (CLASSIC)
Yandex	Trojan.GenAsa!wci/eCVeP1Q
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Adware/Zeno
AVG	Win32:AdwareX-gen [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_90% (W)

How to remove Trojan:Win32/Cosmu.AC!MTB?

Trojan:Win32/Cosmu.AC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X